Techniques for prefix subnetting

ABSTRACT

A delegated internet protocol version six prefix, which is assigned to a gateway device which is interposed between an internet and a premises, is divided into a lower-numbered portion and a higher-numbered portion. One of the portions is allocated to a plurality of networks associated with the premises. The other is broken into a plurality of blocks for use in prefix delegation for allocation to routers associated with the premises requesting the prefix delegation. The gateway device is operated in accordance with the dividing, allocating, and breaking steps. Optionally, at least some of the plurality of networks associated with the premises are pre-categorized into at least first and second trust zones, and the operating step further includes operating the gateway device in accordance with the pre-categorizing step. Apparatuses, devices, computer program products, and internet protocol version four embodiments are also provided.

FIELD OF THE INVENTION

The present invention relates generally to the electrical, electronic,and computer arts, and more particularly relates to network technologyand the like.

BACKGROUND OF THE INVENTION

The great majority of the Internet currently utilizes Internet ProtocolVersion 4 (IPv4). The address space in IPv4 is becoming exhausted. Theeventual exhaustion of the IPv4 address space was recognized some timeago and a common technique of dealing with it was developed. Thistechnique employs network address translation (NAT) wherein a number ofprivate IPv4 addresses, such as within a home or small business network,“hide” behind a single public IPv4 address.

Currently, residences and small businesses obtain access to the Internetvia a number of techniques. One example is by subscribing through acable multiple system operator (MSO); such an MSO may provide a varietyof services such as broadcast television, Video-On-Demand (VOD),broadband data services, IP telephony, and the like.

In this regard, with the advent of digital communications technology,many TV program streams are transmitted in digital formats. For example,Digital Satellite System (DSS). Digital Broadcast Services (DBS), andAdvanced Television Standards Committee (ATSC) program streams aredigitally formatted pursuant to the well-known Moving Pictures ExpertsGroup 2 (MPEG-2) standard. The MPEG-2 standard specifies, among otherthings, the methodologies for video and audio data compression allowingfor multiple programs, with different video and audio feeds, to bemultiplexed in a transport stream traversing a single transmissionchannel. A digital TV receiver may be used to decode an MPEG-2 encodedtransport stream, and extract the desired program therefrom.

The compressed video and audio data are typically carried by continuouselementary streams, respectively, which are broken into access units orpackets, resulting in packetized elementary streams (PESs). Thesepackets are identified by headers that contain time stamps forsynchronizing, and are used to form MPEG-2 transport streams. Fordigital broadcasting, multiple programs and their associated PESs aremultiplexed into a single transport stream. A transport stream has PESpackets further subdivided into short fixed-size data packets, in whichmultiple programs encoded with different clocks can be carried. Atransport stream not only includes a multiplex of audio and video PESs,but also other data such as MPEG-2 program specific information(sometimes referred to as metadata) describing the transport stream. TheMPEG-2 metadata may include a program associated table (PAT) that listsevery program in the transport stream. Each entry in the PAT points toan individual program map table (PMT) that lists the elementary streamsmaking up each program. Some programs are open, but some programs may besubject to conditional access (encryption), and this information (i.e.,whether open or subject to conditional access) is also carried in theMPEG-2 transport stream, typically as metadata.

The aforementioned fixed-size data packets in a transport stream eachcarry a packet identifier (PID) code. Packets in the same elementarystreams all have the same PID, so that a decoder can select theelementary stream(s) it needs and reject the remainder.Packet-continuity counters may be implemented to ensure that everypacket that is needed to decode a stream is received.

SUMMARY OF THE INVENTION

Techniques are provided for prefix subnetting.

In one aspect, an exemplary method includes the steps of dividing adelegated internet protocol version six prefix, which is assigned to agateway device which is interposed between an internet and a premises,into a lower-numbered portion and a higher-numbered portion; allocatingone of the lower-numbered portion and the higher-numbered portion to aplurality of networks associated with the premises; breaking another oneof the lower-numbered portion and the higher-numbered portion into aplurality of blocks for use in prefix delegation for allocation torouters associated with the premises requesting the prefix delegation;and operating the gateway device in accordance with the dividing,allocating, and breaking steps.

In another aspect, another exemplary method includes the steps ofobtaining an internet protocol version four public address associatedwith a gateway device which is interposed between an internet and apremises; and, in accordance with predetermined rules, dividing aprivate address space for the premises into at least: a firstsubdivision for at least one of a wired sub-network, a wirelesssub-network, and a multimedia over coaxial cable interface; and a secondsubdivision for at least another one of the wired sub-network, thewireless sub-network, and the multimedia over coaxial cable interface.Further steps include assigning a first trust value to at least aportion of the first subdivision and a second trust value to at least aportion of the second subdivision in accordance with the predeterminedrules; and operating the gateway device in accordance with theobtaining, dividing, and assigning steps.

In still another aspect, a gateway device is provided for interpositionbetween an internet and a premises. The gateway device includes a memoryand at least one processor, which is coupled to the memory, andoperative to carry out or otherwise facilitate performance of one ormore method steps.

As used herein, “facilitating” an action includes performing the action,making the action easier, helping to carry the action out, or causingthe action to be performed. Thus, by way of example and not limitation,instructions executing on one processor might facilitate an actioncarried out by instructions executing on a remote processor, by sendingappropriate data or commands to cause or aid the action to be performed.For the avoidance of doubt, where an actor facilitates an action byother than performing the action, the action is nevertheless performedby some entity or combination of entities.

One or more embodiments of the invention or elements thereof can beimplemented in the form of an article of manufacture including a machinereadable medium that contains one or more programs which when executedimplement such step(s); that is to say, a computer program productincluding a tangible computer readable recordable storage medium (ormultiple such media) with computer usable program code for performingthe method steps indicated. Furthermore, one or more embodiments of theinvention or elements thereof can be implemented in the form of anapparatus including a memory and at least one processor that is coupledto the memory and operative to perform, or facilitate performance of,exemplary method steps. Yet further, in another aspect, one or moreembodiments of the invention or elements thereof can be implemented inthe form of means for carrying out one or more of the method stepsdescribed herein; the means can include (i) specialized hardwaremodule(s), (ii) software module(s) stored in a tangiblecomputer-readable recordable storage medium (or multiple such media) andimplemented on a hardware processor, or (iii) a combination of (i) and(ii); any of (i)-(iii) implement the specific techniques set forthherein.

One or more embodiments of the invention can provide substantialbeneficial technical effects, including, for example:

-   -   ability to provide individual networks to every potential device        within the premises (as opposed to merely individual addresses);    -   creation of security realms wherein different parts of the        network are segmented from each other; and    -   avoid need to use NAT.

These and other features and advantages of the invention will becomeapparent from the following detailed description of illustrativeembodiments thereof, which is to be read in connection with theaccompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a functional block diagram illustrating an exemplary hybridfiber-coaxial (HFC) network configuration;

FIG. 1A is a functional block diagram illustrating one exemplary HFCcable network head-end configuration;

FIG. 1B is a functional block diagram illustrating one exemplary localservice node configuration;

FIG. 2 is a functional block diagram of a content and data distributionnetwork configured in accordance with one embodiment of the invention;

FIG. 3 is a functional block diagram of an exemplary centralized CPEunit configured in accordance with one embodiment of the invention;

FIG. 4 is a table depicting the number of /64 networks corresponding toeach of a plurality of prefix lengths, as known in the prior art;

FIG. 5 shows a first exemplary /56 option for network allocation andsub-prefix delegation, according to an aspect of the invention;

FIG. 6 shows a second exemplary /56 option for network allocation andsub-prefix delegation, according to an aspect of the invention;

FIG. 7 shows a third exemplary /56 option for network allocation andsub-prefix delegation, according to an aspect of the invention;

FIG. 8 shows exemplary IPv4 public and private sub-network allocation;

FIG. 9 shows exemplary IPv4 and IPv6 zones and groups, according to anaspect of the invention;

FIG. 10 is a flow chart of exemplary method steps, according to anaspect of the invention; and

FIG. 11 is a block diagram of an exemplary computer system useful inimplementing at least a portion of one or more embodiments of theinvention.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Embodiments of the invention may be employed in a variety of settings. Anon-limiting exemplary embodiment will be described within the contextof a content-based network.

FIG. 1 illustrates a typical content-based network configuration 100.The various components of the network 100 include (i) one or more dataand application origination points 102; (ii) one or more content sources103, (iii) one or more application distribution servers 104; (iv) one ormore video-on-demand (VOD) servers 105, and (v) consumer (or customer)premises equipment (CPE) 106. In a preferred approach, at least some ofthe CPE 106 are advanced wireless gateway apparatuses as describedhereinafter and shown in FIGS. 2 and 3. Also included is a dynamicbandwidth allocation device (DBWAD) 1001 such as a global sessionresource manager, which is itself a non-limiting example of a sessionresource manager. The distribution server(s) 104, VOD servers 105, DBWAD1001, and CPE(s) 106 are connected via a bearer (e.g., hybrid fibercable (HFC)) network 101. A simple architecture is shown in FIG. 1 forillustrative brevity, although it will be recognized that comparablearchitectures with multiple origination points, distribution servers,VOD servers, and/or CPE devices (as well as different networktopologies) may be utilized consistent with the invention. For example,the head-end architecture of FIG. 1A (described in greater detail below)may be used.

It should be noted at this point that in addition to a conventional HFCnetwork or a switched digital network, other kinds of video contentnetworks can be employed for network 101 (e.g., fiber-to-the-home (FTTH)or fiber-to-the-curb (FTTC); digital subscriber line (DSL); wirelessnetworks such as Wi-Fi, WiMAX (Worldwide Interoperability for MicrowaveAccess), 3GPP Long Term Evolution (LTE), various 4G standards; and thelike). Again, for the avoidance of doubt, the HFC network details setforth herein are merely provided to show one non-limiting exemplaryenvironment and it is to be emphasized that embodiments of the inventioncan be employed in many different situations where a gateway device orthe like is interposed between: (i) the Internet or another internet;and (ii) a premises or the like.

The data/application origination point 102 comprises any medium thatallows data and/or applications (such as a VOD-based or “Watch TV”application) to be transferred to a distribution server 104 (forexample, over a suitable network, not separately numbered). This caninclude for example a third party data source, application vendorwebsite, compact disk read-only memory (CD-ROM), external networkinterface, mass storage device (e.g., Redundant Arrays of InexpensiveDisks (RAID) system), etc. Such transference may be automatic, initiatedupon the occurrence of one or more specified events (such as the receiptof a request packet or acknowledgement (ACK)), performed manually, oraccomplished in any number of other modes readily recognized by those ofordinary skill.

The application distribution server 104 comprises a computer systemwhere such applications can enter the network system. Distributionservers per se are well known in the networking arts.

The VOD server 105 comprises a computer system where on-demand contentcan be received from one or more of the aforementioned data sources 102and enter the network system. These servers may generate the contentlocally, or alternatively act as a gateway or intermediary from adistant source.

The CPE 106 includes any equipment in the customers' premises (or otherappropriate locations) that can be accessed by a distribution server104; for example, set-top terminal (STT), digital set-top box (DSTB),set-top box (STB), or simply “box,” and the like. As noted above, in apreferred approach, at least some of the CPE 106 are advanced wirelessgateway apparatuses as described hereinafter and shown in FIGS. 2 and 3.

Referring now to FIG. 1A, one exemplary embodiment of a head-endarchitecture is described. As shown in FIG. 1A, the head-endarchitecture 150 comprises typical head-end components and servicesincluding billing module 152, subscriber management system (SMS) and CPEconfiguration management module 3308, cable-modem termination system(CMTS) and out-of-band (OOB) system 156, as well as LAN(s) 158, 160placing the various components in data communication with one another.It will be appreciated that while a bar or bus LAN topology isillustrated, any number of other arrangements (e.g., ring, star, etc.)may be used consistent with the invention. It will also be appreciatedthat the head-end configuration depicted in FIG. 1A is high-level,conceptual architecture and that each multi-service operator or multiplesystem operator (MSO) may have multiple head-ends deployed using customarchitectures.

The architecture 150 of FIG. 1A further includes amultiplexer/encrypter/modulator (MEM) 162 coupled to the HFC network 101adapted to “condition” content for transmission over the network. Thedistribution servers 104 are coupled to the LAN 160, which providesaccess to the MEM 162 and network 101 via one or more file servers 170.The VOD servers 105 are coupled to the LAN 158, although otherarchitectures may be employed (such as for example where the VOD serversare associated with a core switching device such as an 802.3z GigabitEthernet device; or the VOD servers could be coupled to LAN 160). Sinceinformation is typically carried across multiple channels, the head-endshould be adapted to acquire the information for the carried channelsfrom various sources. Typically, the channels being delivered from thehead-end 150 to the CPE 106 (“downstream”) are multiplexed together inthe head-end and sent to neighborhood hubs (see FIG. 1B) via a varietyof interposed network components.

Content (e.g., audio, video, etc.) is provided in each downstream(in-band) channel associated with the relevant service group. Tocommunicate with the head-end or intermediary node (e.g., hub server),the CPE 106 may use the out-of-band (OOB) or DOCSIS® (Data Over CableService Interface Specification) channels (registered mark of CableTelevision Laboratories, Inc., 400 Centennial Parkway Louisville, Colo.80027, USA) and associated protocols (e.g., DOCSIS 1.x, 2.0, or 3.0).The OpenCable™ Application Platform. (OCAP) 1.0, 2.0, 3.0 (andsubsequent) specification (Cable Television laboratories Inc.) providesfor exemplary networking protocols both downstream and upstream,although the invention is in no way limited to these approaches. Allversions of the DOCSIS and OCAP specifications are expresslyincorporated herein by reference in their entireties for all purposes.Other pertinent materials include the Data-Over-Cable Service InterfaceSpecifications, IPv4 and IPv6 eRouter Specification (version 1.0 and anyother versions), CM-SP-eRouter-105-110210, and the Data-Over-CableService Interface Specifications, DOCSIS Set-top Gateway (DSG) InterfaceSpecification, CM-SP-DSG-117-110210, both available from CableTelevision Laboratories, Inc., and both expressly incorporated herein byreference in their entireties for all purposes.

It will also be recognized that multiple servers (broadcast, VOD, orotherwise) can be used, and disposed at two or more different locationsif desired, such as being part of different server “farms”. Thesemultiple servers can be used to feed one service group, or alternativelydifferent service groups. In a simple architecture, a single server isused to feed one or more service groups. In another variant, multipleservers located at the same location are used to feed one or moreservice groups. In yet another variant, multiple servers disposed atdifferent location are used to feed one or more service groups.

In some instances, material may also be obtained from a satellite feed1108; such material is demodulated and decrypted in block 1106 and fedto block 162. Conditional access system 157 may be provided for accesscontrol purposes. Network management system 1110 may provide appropriatemanagement functions. Note also that signals from MEM 162 and upstreamsignals from network 101 that have been demodulated and split in block1112 are fed to CMTS and OOB system 156.

Also included in FIG. 1A are a global session resource manager (GSRM)3302, a Mystro Application Server 104A, and a business management system154, all of which are coupled to LAN 158. GSRM 3302 is one specific formof a DBWAD 1001 and is a non-limiting example of a session resourcemanager.

As shown in FIG. 1B, the network 101 of FIGS. 1 and 1A comprises afiber/coax arrangement wherein the output of the MEM 162 of FIG. 1A istransferred to the optical domain (such as via an optical transceiver177 at the head-end 150 or further downstream). The optical domainsignals are then distributed to a fiber node 178, which furtherdistributes the signals over a distribution network 180 to a pluralityof local servicing nodes 182. This provides an effective 1:N expansionof the network at the local service end.

US Patent Publication 2003-0056217 of Paul D. Brooks, entitled“Technique for Effectively Providing Program Material in a CableTelevision System,” the complete disclosure of which is expresslyincorporated herein by reference for all purposes, describes oneexemplary broadcast switched digital architecture useful with one ormore embodiments of the present invention, although it will berecognized by those of ordinary skill that other approaches andarchitectures may be substituted. In a cable television system inaccordance with the Brooks invention, program materials are madeavailable to subscribers in a neighborhood on an as needed basis.Specifically, when a subscriber at a set-top terminal selects a programchannel to watch, the selection request is transmitted to a head end ofthe system. In response to such a request, a controller in the head enddetermines whether the material of the selected program channel has beenmade available to the neighborhood. If it has been made available, thecontroller identifies to the set-top terminal the carrier which iscarrying the requested program material, and to which the set-topterminal tunes to obtain the requested program material. Otherwise, thecontroller assigns an unused carrier to carry the requested programmaterial, and informs the set-top terminal of the identity of the newlyassigned carrier. The controller also retires those carriers assignedfor the program channels which are no longer watched by the subscribersin the neighborhood.

Note that reference is made herein, for brevity, to features of the“Brooks invention”—it should be understood that no inference should bedrawn that such features are necessarily present in all claimedembodiments of Brooks.

The Brooks invention is directed to a technique for utilizing limitednetwork bandwidth to distribute program materials to subscribers in acommunity access television (CATV) system. In accordance with the Brooksinvention, the CATV system makes available to subscribers selectedprogram channels, as opposed to all of the program channels furnished bythe system as in prior art. In the Brooks CATV system, the programchannels are provided on an as needed basis, and are selected to servethe subscribers in the same neighborhood requesting those channels.

US Patent Publication 2010-0313236 of Albert Straub, entitled“TECHNIQUES FOR UPGRADING SOFTWARE IN A VIDEO CONTENT NETWORK,” thecomplete disclosure of which is expressly incorporated herein byreference for all purposes, provides additional details on theaforementioned dynamic bandwidth allocation device.

US Patent Publication 2009-0248794 of William L. Helms, entitled “SYSTEMAND METHOD FOR CONTENT SHARING,” the complete disclosure of which isexpressly incorporated herein by reference for all purposes, providesadditional details on CPE in the form of a converged premises gatewaydevice. Related aspects are also disclosed in US Patent Publication2007-0217436 of Markley et al, entitled “METHODS AND APPARATUS FORCENTRALIZED CONTENT AND DATA DELIVERY,” the complete disclosure of whichis expressly incorporated herein by reference for all purposes.

Reference should now be had to FIG. 2, which presents a block diagram ofa premises network interfacing with a head end of an MSO or the like,providing Internet access. An exemplary advanced wireless gatewaycomprising CPE 106, incorporating aspects of the invention, is depictedas well.

CPE 106 includes an advanced wireless gateway which connects to a headend 150 or other hub of a network, such as a video content network of anMSO or the like. The head end is coupled also to an internet (e.g., theInternet) 208 which is located external to the head end 150, such as viaan Internet (IP) backbone or gateway (not shown).

The head end is in the illustrated embodiment coupled to multiplehouseholds or other premises, including the exemplary illustratedhousehold 240. In particular, the head end (for example, a cable modemtermination system thereof) is coupled via the aforementioned HFCnetwork and local coaxial cable or fiber drop to the premises, includingthe consumer premises equipment (CPE) 106. The exemplary CPE 106 is insignal communication with any number of different devices including,e.g., a wired telephony unit 222, a Wi-Fi or other wireless-enabledphone 224, a Wi-Fi or other wireless-enabled laptop 226, a sessioninitiation protocol (SIP) phone, an H.323 terminal or gateway, etc.Additionally, the CPE 106 is also coupled to a digital video recorder(DVR) 228 (e.g., over coax), in turn coupled to television 234 via awired or wireless interface (e.g., cabling, PAN or 802.15 UWB micro-net,etc.). CPE 106 is also in communication with a network (here, anEthernet network compliant with IEEE Std. 802.3, although any number ofother network protocols and topologies could be used) on which is apersonal computer (PC) 232.

Other non-limiting exemplary devices that CPE 106 may communicate withinclude a printer 294; for example over a universal plug and play (UPnP)interface, and/or a game console 292; for example, over a multimediaover coax alliance (MoCA) interface.

CPE 106 is also in signal communication with one or more roamingdevices, generally represented by block 290. Communication with suchdevices will be discussed in greater detail below.

A home LAN″ (HLAN) is created in the exemplary embodiment, which mayinclude for example the network formed over the installed coaxialcabling in the premises, the Wi-Fi network, and so forth.

During operation, the CPE 106 exchanges signals with the head end overthe interposed coax (and/or other, e.g., fiber) bearer medium. Thesignals include e.g., Internet traffic, digital programming and otherdigital signaling or content such as digital (packet-based; e.g., VoIP)telephone service. The CPE 106 then exchanges this digital informationafter demodulation and any decryption (and any demultiplexing) to theparticular system(s) to which it is directed or addressed. For example,in one embodiment, a MAC address or IP address can be used as the basisof directing traffic within the client-side environment 240.

Any number of different data flows may occur within the network depictedin FIG. 2. For example, the CPE 106 may exchange digital telephonesignals from the head end which are further exchanged with the telephoneunit 222, the Wi-Fi phone 224, or one or more roaming devices 290. Thedigital telephone signals may be IP-based such as Voice-over-IP (VoIP),or may utilize another protocol or transport mechanism. The well knownsession initiation protocol (SIP) may be used, for example, in thecontext of a “SIP phone” for making multi-media calls. The network mayalso interface with a cellular or other wireless system, such as forexample a 3G IMS (IP multimedia subsystem) system, in order to providemultimedia calls between a user or consumer in the household domain 240(e.g., using a SIP phone or H.323 terminal) and a mobile 3G telephone orpersonal media device (PMD) user via that user's radio access network(RAN).

The CPE 106 may also exchange Internet traffic (e.g., TCP/IP and otherpackets) with the head end 150 which is further exchanged with the Wi-Filaptop 226, the PC 232, one or more roaming devices 290, or otherdevice. CPE 106 may also receive digital programming that is forwardedto the DVR 228 or to the television 234. Programming requests and othercontrol information may be received by the CPE 106 and forwarded to thehead end as well for appropriate handling.

FIG. 3 is a block diagram of one exemplary embodiment of the CPE 106 ofFIG. 2. The exemplary CPE 106 includes an RF front end 301, Wi-Fiinterface 302, video interface 316, “Plug n' Play” (PnP) interface 318(for example, a UPriP interface) and Ethernet interface 304, eachdirectly or indirectly coupled to a bus 312. As will be discussedfurther below, in one or more embodiments, Wi-Fi interface 302 comprisesa single wireless access point (WAP) running multiple (“m”) service setidentifiers (SSIDs). For the avoidance of doubt, in one or moreembodiments, multiple SSIDs, which could represent differentapplications, are served from a common WAP. For example, SSID 1 is forthe home user, while SSID 2 may be for a managed security service, SSID3 may be a managed home networking service, SSID 4 may be a hot spot,and so on. Each of these is on a separate IP subnetwork for security,accounting, and policy reasons. The microprocessor 306, storage unit308, plain old telephone service (POTS)/public switched telephonenetwork (PSTN) interface 314, and memory unit 310 are also coupled tothe exemplary bus 312, as is a suitable MoCA interface 391. The memoryunit 310 typically comprises a random access memory (RAM) and storageunit 308 typically comprises a hard disk drive, an optical drive (e.g.,CD-ROM or DVD), NAND flash memory, RAID (redundant array of inexpensivedisks) configuration, or some combination thereof.

The illustrated CPE 106 can assume literally any discrete form factor,including those adapted for desktop, floor-standing, or wall-mounteduse, or alternatively may be integrated in whole or part (e.g., on acommon functional basis) with other devices if desired.

Every embodiment need not necessarily have all the elements shown inFIG. 3.

It will be recognized that while a linear or centralized busarchitecture is shown as the basis of the exemplary embodiment of FIG.3, other bus architectures and topologies may be used. For example, adistributed or multi-stage bus architecture may be employed. Similarly,a “fabric” or other mechanism (e.g., crossbar switch, RAPIDIO interface,non-blocking matrix, TDMA or multiplexed system, etc.) may be used asthe basis of at least some of the internal bus communications within thedevice. Furthermore, many if not all of the foregoing functions may beintegrated into one or more integrated circuit (IC) devices in the formof an ASIC or “system-on-a-chip” (SoC). Myriad other architectures wellknown to those in the data processing and computer arts may accordinglybe employed.

It will also be recognized that the CPE configuration shown isessentially for illustrative purposes, and various other configurationsof the CPE 106 are consistent with other embodiments of the invention.For example, the CPE 106 in FIG. 3 may not include all of the elementsshown, and/or may include additional elements and interfaces such as forexample an interface for the HomePlug A/V standard which transmitsdigital data over power lines, a PAN (e.g., 802.15), Bluetooth, or othershort-range wireless interface for localized data communication, etc.

A suitable number of standard 10/100/1000 Base T Ethernet ports for thepurpose of a Home LAN connection are provided in the exemplary device ofFIG. 3; however, it will be appreciated that other rates (e.g., GigabitEthernet or 10-Gig-E) and local networking protocols (e.g., MoCA, USB,etc.) may be used. These interfaces may be serviced via a WLANinterface, wired RJ-45 ports, or otherwise. The CPE 106 can also includea plurality of RJ-11 ports for telephony interface, as well as aplurality of USB (e.g., USB 2.0) ports, and IEEE-1394 (Firewire) ports.S-video and other signal interfaces may also be provided if desired.

During operation of the CPE 106, software located in the storage unit308 is run on the microprocessor 306 using the memory unit 310 (e.g., aprogram memory within or external to the microprocessor). The softwarecontrols the operation of the other components of the system, andprovides various other functions within the CPE. Other systemsoftware/firmware may also be externally reprogrammed, such as using adownload and reprogramming of the contents of the flash memory,replacement of files on the storage device or within other non-volatilestorage, etc. This allows for remote reprogramming or reconfiguration ofthe CPE 106 by the MSO or other network agent.

The RF front end 301 of the exemplary embodiment comprises a cable modemof the type known in the art. In this fashion, content or data normallystreamed over the cable modem can be received and distributed by the CPE106, such as for example packetized video (e.g., IPTV). The digital dataexchanged using RF front end 301 includes IP or other packetizedprotocol traffic that provides access to internet service. As is wellknown in cable modem technology, such data may be streamed over one ormore dedicated QAMs resident on the HFC bearer medium, or evenmultiplexed or otherwise combined with QAMs allocated for contentdelivery, etc. The packetized (e.g., IP) traffic received by the CPE 106may then be exchanged with other digital systems in the localenvironment 240 (or outside this environment by way of a gateway orportal) via, e.g. the Wi-Fi interface 302, Ethernet interface 304 orplug-and-play (PnP) interface 318.

It will be appreciated, however, that the RF front end 301 of the CPEmay comprise (either in addition to or in place of the cable modern) atraditional video RF front end 301 (e.g., tuner) adapted to receivevideo signals over, e.g., a QAM. For example, one exemplary embodimentof the RF front end 301 comprises one or more tuners, a demodulator,decryption module, and demultiplexer of the type well known in the art,although other configurations may be used. Additionally, the RF frontend 301 modulates, encrypts/multiplexes as required, and transmitsdigital information for receipt by upstream entities such as the CMTS ora network server. Digital data transmitted via the RF front end 301 mayinclude, for example, MPEG-2 encoded programming data that is forwardedto a television monitor via the video interface 316. Programming datamay also be stored on the CPE storage unit 308 for later distribution byway of the video interface 316, or using the Wi-Fi interface 302,Ethernet interface 304, Firewire (IEEE Std 1394), USB/USB2, or anynumber of other such options.

Other devices such as portable music players (e.g., MP3 audio players)may be coupled to the CPE 106 via any number of different interfaces,and music and other media files downloaded for portable use and viewing.

In some instances, the CPE 106 includes a DOCSIS cable modem fordelivery of traditional broadband Internet services. This connection canbe shared by all Internet devices in the premises 240; e.g. Internetprotocol television (IPTV) devices, PCs, laptops, etc., as well as byroaming devices 290. In addition, the CPE 106 can be remotely managed(such as from the head end 150, or another remote network agent) tosupport appropriate IP services.

In some instances the CPE 106 also creates a home Local Area Network(LAN) utilizing the existing coaxial cable in the home. For example, anEthernet-over-coax based technology allows services to be delivered toother devices in the home utilizing a frequency outside (e.g., above)the traditional cable service delivery frequencies. For example,frequencies on the order of 1150 MHz could be used to deliver data andapplications to other devices in the home such as PCs, PMDs, mediaextenders and set-top boxes. The coaxial network is merely the bearer;devices on the network utilize Ethernet or other comparable networkingprotocols over this bearer.

The exemplary CPE 106 shown in FIGS. 2 and 3 acts as a Wi-Fi accesspoint (AP), thereby allowing Wi-Fi enabled devices to connect to thehome network and access Internet, media, and other resources on thenetwork.

In one embodiment, Wi-Fi interface 302 comprises a single wirelessaccess point (WAP) running multiple (“m”) service set identifiers(SSIDs). One or more SSIDs can be set aside for the home network whileone or more SSIDs can be set aside for roaming devices 290.

A premises gateway software management package (application) is alsoprovided to control, configure, monitor and provision die CPE 106 fromthe cable head-end 150 or other remote network node via the cable modem(DOCSIS) interface. This control allows a remote user to configure andmonitor the CPE 106 and home network.

The MoCA interface 391 can include, for example, a MoCA, retailcompliant F-connector for providing data over coax capability. Theexemplary MoCA port operates in the 1125-1525 MHz band, although otherfrequencies (MoCA compliant or otherwise) may be used for this purposeif desired. The MoCA frequencies can be multiplexed onto the cable inputport of the CPE 106, or sent over another channel (e.g., dedicatedchannel or interface). The CPE 106 also optionally includes a switchedpacket interface between the Ethernet port and the MoCA interface. Inone embodiment, data traffic flows through the CPE 106 between theEthernet or other network interface and MoCA ports. In some cases, thisoccurs without requiring host processor intervention; in otherinstances, host processor intervention is a possibility.

As discussed above, the exemplary Wi-Fi wireless interface 302 is alsoconfigured to provide a plurality of unique service set identifiers(SSIDs) simultaneously. These SSIDs are configurable (locally orremotely), such as via a web page.

As alluded to elsewhere herein, in a non-limiting exemplary embodiment,one or more techniques for prefix subnetting are implemented in thecontext of an advanced wireless gateway (AWG). As also discussedelsewhere herein, the IPv4 address space is becoming exhausted. One ormore embodiments allow an entity such as an MSO or other InternetService Provider (ISP) to reduce, for its customers, the amount ofoperational overhead in deploying IPv6. In one or more embodiments, aprefix, which is essentially a block in the IPv6 address the MSO orother ISP assigns to a customer, is then broken down into individualnetworks which are then assigned to the individual network interfacessuch as, by way of example and not limitation, a four port Ethernetswitch, a Multimedia over Coax Alliance (MoCA) interface, and one offour wireless service set identifiers (SSIDs), each of which have theirown IP subnet. In one or more embodiments, the subnetting techniquesadvantageously simplify:

-   -   how to deal with a request for a prefix,    -   how it is assigned to the actual gateway or similar device,    -   setting up a default configuration that has a high probability        of working the majority of the time for most use cases, and    -   how the sub-nets are broken down individually, even in support        of additional routers within the home, small business, or the        like, which is called sub-prefix delegation.

An IPv6 Network is a fixed /64 size including 2⁶⁴(18,446,744,073,709,551,616) IPv6 addresses. FIG. 4 shows the number of/64 networks to each of the listed prefix lengths. As depicted therein,the following prefixes have the following meanings:

-   -   K=1,024    -   M=1,048,576    -   G=1,073,741,824    -   T=1.099,511.627,776

The notation “/” refers to the number of bits in the given prefix. Thatis, the size of a block of addresses is indicated by a slash (/) and thedecimal size of the network prefix; the specific addresses in the blockare not explicitly specified in this approach. For example, an addressblock with 48 bits in the prefix is indicated by /48. Such a blockcontains 2¹²⁸⁻⁴⁸=2⁸⁰ addresses. The smaller the numerical value of thenetwork prefix, the larger the size of the block, since the prefix issubtracted from 128 to obtain the exponent to which two is raised todetermine the number of available addresses. For example, a /56 prefixis four times larger than a /58 prefix (2¹²⁸⁻⁵⁶=2⁷² addresses;2¹²⁸⁻⁵⁸=2⁷⁰ addresses; 2⁷²=2⁷⁰×4).

The skilled artisan will be familiar with IPv4 and IPv6 per se. IPv6specifies a new packet format, designed to minimize packet headerprocessing by routers. IPv6 includes a larger address space, enhancedmulti-casting, stateless address auto-configuration (SLAAC), mandatorysupport for network layer security, simplified processing by routers,enhanced mobility, options extensibility, and support for so-called“jumbograms.”

In order to support future prefix sub-delegation and hierarchal prefixdelegation, a typical site prefix length of /56 can be further brokendown to produce equal size blocks of which half may be used forsub-prefixes within the LAN with which to create additional layers inthe topology.

In a non-limiting example, an advanced wireless gateway or similardevice 106 includes five SSIDs (m=5, two trusted, three un-trusted); onetrusted wired Ethernet LAN segment and one trusted MoCA interface.

Using FIG. 4, and with reference also to FIG. 5, it can be seen thatbreaking a /56 prefix 502 into four equal /58 networks yields thefollowing:

-   -   Two (2)/58 prefixes 504, 506 broken into 128/64s 508 to address        trusted and un-trusted networks; and    -   Eight (8)/60 sub-prefixes 510 for Sub-Prefix        Delegation/Hierarchal Prefix Delegation (16/64 networks each)

Still with reference to FIG. 5, a /56 equals 256/64 networks, with thefour /58 prefixes (previously-mentioned 504 and 506 as well as 512, 514with the eight /60 sub-prefixes underneath) broken out providing 64/64networks each, further subdivided into eight /60 prefixes labeled 510,with 16/64 networks, each with room to grow (network depth and networkwidth). Thus, to summarize, a /56 delegated prefix length 502 allows for256/64 networks. In the example of FIG. 5, the /56 prefix is broken intofour equal /58 prefixes 504, 506, 512, 514. The first of these, 504, isbroken into 64 equal /64 networks 508, including in this case wirednetworks, such as Wired1 and Wired2, and a MoCA network. In thenon-limiting example, wired networks 4-64 are reserved. The second /58network is also broken into 64 equal /64 networks 508, including in thiscase wireless networks, such as SSID1 through SSID5. In the non-limitingexample, wireless networks 6-64 are reserved. The third /58 network 512is broken into four /60 sub-prefixes 510 for a wired LAN, while thefourth /58 network 514 is broken into four /60 sub-prefixes 510 for WiFiSSIDs.

FIG. 5 thus depicts exemplary LAN Interfaces and PD Pools. The exemplaryadvanced wireless gateway or similar device can supply 128/64 networksto trusted and un-trusted wired and wireless clients. In a non-limitingexample, for a first phase of deployment, use of sub-prefix delegationcan be disabled and LAN clients may well use stateless addressauto-configuration (SLAAC) vs. stateful DHCPv6 (dynamic host controlprotocol version 6). Many instances will involve a single router perhome and/or office. In a later phase, sub-PD will be enabled. In one ormore embodiments, the gateway router may “hint” between /64 and /48,however, the advanced wireless gateway or similar device will ignorethese hints and provide a /60 instead.

One or more embodiments also employ the notion of trust relationships.In this regard, there is a zone which is on the outside of the advancedwireless gateway or similar device which is open to the Internet (whichis called “un-trusted”), and anything on the inside of the advancedwireless gateway or similar device is called “trusted.” In this aspect,wireless SSIDs that are not intended to be used by the general publiclike a wireless hot spot environment are secure and considered trusted.On the other hand, a wireless SSID that is associated with a public hotspot presence is un-trusted, as is a DMZ interface (demilitarized zonethat a customer could use to provide a publicly facing Internet server).

One or more embodiments thus associate addresses into groups within atrust environment. In one or more instances, a trusted interface isprovided that is associated only with the interior local area network(LAN) and the address space associated with that is numbered in a veryspecific way such that even without knowing the details of a customer'snetwork, an employee of an MSO or other ISP in a call center candiagnose issues (e.g., a tablet computing device on the home or smallbusiness wireless local area network is not functioning properly). Insome cases, if the interfaces are “up,” an MSO or other ISP will alwaysknow which actual address of the prefix that has been assigned to theparticular customer is actually on that interface and the MSO or otherISP will always use the first address out of the /64 network prefix inorder to assign the same to the actual interface itself. This simplifiesmanagement. On the other hand, in some cases, any router implementing apacket filtering firewall will prevent the MSO from knowing exactly howa customer's network is configured. The typical tools for probing suchinformation, beyond a routing protocol such as ISIS which will onlyexchange routes, not necessarily the entire routing topology of thecustomer's networks, imply that the MSO in such instances will not havethe visibility as described.

Another aspect of one or more embodiments is the trust relationship andhow it can be superimposed over to an existing piece of equipment; in atleast some instances, this aspect simplifies firewall rules. In apreferred but non-limiting embodiment, packets don't travel fromun-trusted to trusted zones; they only travel from trusted to un-trustedzones, i.e., from high to low, never low to high. This aspectadvantageously simplifies security realms within a product, and hasbroad applicability.

As noted, the advanced wireless gateway is but one exemplaryapplication; for example, one or more embodiments can be employed in thecontext of a wired home gateway that communicates over MoCA, wireless,and other techniques. Indeed, interfaces may include wired and/orwireless, and even interfaces currently not yet existing could make useof one or more techniques disclosed herein. Accordingly, while in someinstances, techniques disclosed herein can be applied to an advancedwireless gateway wherein the MSO has a direct relationship with thevendor who supplies the gateway, in other cases, techniques disclosedherein can be applied to retail devices where the MSO does not have adirect vendor relationship to drive the implementation. There is enoughflexibility in the design of one or more embodiments that aspects of theinvention could be used by any number of service providers, includingpotentially telephony companies, wireless-only ISPs, and the like.

In some instances, depending on the architecture, embodiments of theinvention can be employed in connection with set-top boxes (STBs); forexample, a gateway STB which is, in essence, another form of datagateway that delivers video or re-encapsulates IP. In some instances,use can be made of the MoCA interface within a video architecture fordistribution within a home or similar premises (e.g., a small business).

One or more embodiments advantageously improve upon previousimplementations using IPv4 and/or provide a cleaner architecture for usewith IPv6. In one or more embodiments, the IPv4 and IPv6 align closelyso that it is operationally easier to support and less confusing to acustomer if they choose to change configuration. From that standpoint,there are aspects of the invention that are applicable to IPv4. Forexample, if a given Interface of the gateway router had a subnetassigned for IPv4, it would also have an IPv6 prefix assigned and viceversa. While possible, it is presently believed that it would not be abest practice to have IPv4 subnets assigned in one way the router'sinterfaces and do something completely different with IPv6 prefixes froma support and network management perspective.

In any event, one or more embodiments are particularly suited for use inconnection with IPv6, in connection with prefix delegation, because themodels in this regard are quite different as between IPv4 and IPv6.Typical home routers employ IPv4 private address space behind a NAT/NAPTprocess to share one public IPv4 address among many privately addresseddevices. Despite the imminent exhaustion of the IPv4 address space,there is no shortage of IPv4 private address space, as this addressspace is never intended to be routed beyond the home. However, in thecase of IPv6, all the address space inside the home is globally unique,i.e., it is globally scoped address space. Thus, unlike in IPv4 wherethere is a network address translation (NAT) layer to convert theprivate address space to a public IPv4 address, so that access to theglobal Internet is available, in IPv6, all of the addresses are globallyunique and there is no need for NAT. Eliminating the need to maintain aNAT significantly simplifies implementation of the network interface.

In some cases, the MSO is only aware of the length of prefix assigned,and may have no knowledge of the details of how the prefix is furtherdivided and used. In the case of a device such as an advanced wirelessgateway, the MSO may have limited visibility into the network, but manyof these functions may only be enabled when a customer has specificallysubscribed to a managed service. For customers with home routers thatmay conform to one or more embodiments of the invention, the subnetprocess could be the same, but the visibility in how this network spacebeyond the upper level prefix assignment itself might likewise be out ofreach to the MSO.

Again, in many instances, in IPv6 all the address space will beavailable globally and the only restriction will be the firewall rules.One or more embodiments employ the notion of a simple security mechanismsuch as “trusted” vs. “un-trusted.” In one or more embodiments, anythingun-trusted will not be allowed to initiate a connection into the home.However, the connection could be initiated from the inside of the homenetwork to the outside. Another aspect of interest is that in IPv6, oneor more embodiments move beyond previous models of service provisioning,and are no longer limited to merely delivering Internet service to acustomer's personal computer (PC). Heretofore, it has been typical tohave a cable modem which is a bridge that only understands layer 2(Ethernet frames). In IPv6, it can typically be assumed that everythingin the home is routed and that multiple subnets exist within the homenetwork. One or more embodiments thus assign a network block instead ofa single public IPv4 address, as in current techniques. Instead, in oneor more embodiments, every home gets a block of literally billions ofindividual IP addresses which can be further broken clown into smallernetworks inside the home. This is a pertinent aspect of one or moreembodiments.

Thus, one or more embodiments deliver services to a customer's network;the expectation is that the customer has a network, or that an entitysuch as an MSO or the like is giving the customer equipment to buildone. Heretofore, the customer might have a network, but the network wasreally being treated as a PC behind a cable modern.

It should be noted that one or more embodiments of the invention can beimplemented in a variety of hardware platforms, and the block diagramsherein are a non-limiting example.

In one or more embodiments, the aforementioned trust zones serve as thepolicy or driver of the firewall.

One or more embodiments define one or more standardized techniques forbreaking an IPv6 prefix delegated by a service provider (an MSO is anon-limiting example) down into individual networks and sub-prefixes.One or more embodiments also cover a method for applying access controlto a group of interfaces. It is believed that no currentcommercially-available consumer gateway router permits prefix delegationof networks larger than a /60 IPv6 prefix. One or more embodimentsprovide techniques by which a globally unique IPv6 prefix is allocatedinto specific /64 networks which are applied from the lowest-numbered tothe highest-numbered network address and applied to the interfaces of anadvanced wireless gateway or the like. One or more embodiments areapplicable to such advanced wireless gateways as may be provided by anMSO or the like, as well as to commodity gateway routers obtained by acustomer through retail. In addition, one or more embodiments providetechniques to define trust relationships between and among theinterfaces of the advanced wireless gateway or the like to establishdefault firewall access rules and rules for changing the configurationto meet specific customer requirements.

As noted, it is envisioned that the IPv6 protocol will at first augmentand eventually replace the IPv4 protocol currently in use as theremaining blocks of IPv4 address space become completely exhausted. Anon-limiting exemplary embodiment makes use of an advanced wirelessgateway in the form of an approved DOCSIS 3.0 cable modem with gatewayrouter functions. Such equipment could, for example, be supplied tocustomers of an MSO. In some instances, customers with wideband servicetiers could receive such devices before other customers.

Prefix Delegation (PD) is the process of providing a customer with aprefix that is large enough to allow the customer to further sub-dividethe customer's leased prefix into individual networks within thecustomer's home or office Local Area Network (LAN) environment. There isvalue in creating a consistent approach for how the prefix is brokendown in specific detail as this impacts product requirements (e.g., forthe aforementioned advanced wireless gateway or similar device) that anMSO or the like conveys to vendors, as well as the consistency of theinstallation processes and support models of the MSO or similar entity.

In one or more embodiments, the size of the network allocations withinthe advanced wireless gateway or similar device are well-chosen formeeting the needs of the MSO or similar entity, but may be of adifferent size so long as the overall numbering technique is maintained.In exemplary embodiments, the advanced wireless gateway or similardevice will itself always request a /56 prefix by default, but may alsorequest a different size. Such request may be made, for example, toDHCP-PD (dynamic host control protocol—prefix delegation) servers of anMSO or the like. DHCP-PD servers could be located anywhere within theMSO access network, by way of example and not limitation in a head end150 (e.g., DHCP server 3304 on LAN 158 but could also be on LAN 160),data center, or the like. Furthermore, in cases of sub-prefixdelegation, even the router itself will have a DHCP server running onit. Thus, the DHCP server can be in the head end, data center, or eventhe premises (e.g., in the case of sub-delegation).

Many instances address a situation where the advanced wireless gatewayor similar device acts as both an “edge” facing the MSO or the like anda “core” serving all clients within the customer home network. However,in some use cases (for example, in the short to mid-term), the advancedwireless gateway or similar device will supply Prefix Delegation (PD)information in addition to allocating /64 networks to additional routerswithin the customer's LAN (local area network). In such use cases, theadditional routers within the customer's network will typically requesta prefix to be delegated to them from the advanced wireless gateway orsimilar device. Many routers will supply a “hint” in their request forhow large a network they wish to receive. One or more embodimentsprovide techniques by which the advanced wireless gateway or similardevice will use the hint information to round up or down in order tosupply a specific sub-prefix to the downstream router that isappropriate based on the size of the prefix delegated to the advancedwireless gateway or similar device itself.

In one or more embodiments, each prefix is from a DHCP scope and/or poolassociated with a specific interface that the requesting “core” routeris directly connected to and each prefix is within the limits of theprefix length the MSO or similar entity has provided to the advancedwireless gateway or similar device acting as the “edge.” For example, ifthe MSO or similar entity supplies a /56 prefix to the advanced wirelessgateway or similar device, the routers that are “deeper” within thecustomer LAN may “hint” in their request for a /56 prefix, but theadvanced wireless gateway or similar device will ignore this and supplya /60 instead. The advanced wireless gateway or similar device willbuild a list of candidate /60 prefixes whenever it receives a delegatedprefix from the MSO or similar entity, allowing the advanced wirelessgateway or similar device to supply up to 8 such /60 prefixes with aspecific /60 (the lowest vs. highest numbered prefix) associated withindividual interfaces of the advanced wireless gateway or similardevice, including both wired and wireless interfaces.

It is believed that the current approaches for breaking down an IPv6prefix have been largely devoid of practical use cases and do notsatisfy realistic near to medium term requirements for IPv6 deployment.One or more embodiments provide elegant techniques for breaking up acustomer's delegated prefix on the router platform of an advancedwireless gateway or similar device so that each of the definedinterfaces will always use a specific, predictable part of the prefixeven as the size of the delegated prefix is increased or decreased insize. One or more embodiments provide a more consistent management modelin order to simplify support at both the time of installation and duringuse, through the appropriate support groups, that is applicable to bothmanaged and unmanaged service tiers.

Referring again to FIG. 5, in a non-limiting exemplary embodiment, eachof the wireless SSIDs, the entire four-port Ethernet switch, and theMoCA interface have individual IP subnets which are numbered in aspecific way. The delegated prefix is broken into constituent parts inthe following manner:

-   -   The prefix is first broken into two halves.    -   The lower numbered half is further broken into equal halves 504,        506 from which individual /64 networks are allocated.        -   The lower numbered quarter 504 is dedicated to wired            networks.            -   The lowest numbered /64 network 508, Wired1, is assigned                to the Ethernet switch and associated with the first                trust zone.            -   The next higher numbered /64 network 508, Wired2, is                assigned to the Ethernet switch and associated with the                second trust zone, if needed (off by default).        -   The higher numbered quarter 506 is dedicated to wireless            networks.            -   The lowest numbered /64 network 508 is assigned to the                first WiFi SSID (SSID1) and associated with the first                trust zone.            -   The next higher numbered /64 network 508 is assigned to                the second WiFi SSID (SSID2) and associated with the                first trust zone.    -   The higher numbered half is broken into individual equal-sized        prefixes of /60 510 for use in Prefix Delegation (PD) for        allocation to routers within the customer network requesting PD.

As alluded to above, one or more embodiments break the advanced wirelessgateway or similar device into conceptual “trust zones” in which theinterfaces are grouped into zones which are either implicitly allowed tocommunicate with each other (trusted) or expressly forbidden from doingso (un-trusted). This “trust zone” aspect of one or more embodimentssupplies default firewall behavior to control traffic flow between andamong zones while providing flexibility for both residential andcommercial services tiers when reconfiguration is needed to createadditional zones.

One or more embodiments also associate a trust model that denotesfirewall behaviors across the various interfaces of an advanced wirelessgateway or similar device. A non-limiting exemplary advanced wirelessgateway or similar device has four Ethernet interfaces 304, fivewireless SSIDs=5) and a MoCA interface 391. The four-port Ethernetswitch may be part of a single trusted “zone” along with as many asthree WiFi SSIDs. One or more SSIDs and/or Ethernet ports are associatedwith a second trusted zone and/or or one or more un-trusted zones. Theun-trusted zones of the advanced wireless gateway or similar device aredefined to allow servers that are exposed to the public Internet. Thetrust model affects how packets are allowed to flow; in one or moreexemplary embodiments, packets are only allowed to flow from a highertrust to a lower trust, not the other way around. For example, packetssourced from an un-trusted zone (usually associated with the Internet)cannot gain access to the customer's computer system or DVR contentstore located on a trusted zone.

Many commercial tiers of service permit customers to operate publiclyaccessible servers across the service provided by an MSO or similarentity. Furthermore, future networks may include public “hot spots”provided from a customer's advanced wireless gateway or similar device,which will require public access. In one or more embodiments, theEthernet and wireless cases outlined above form the typical “un-trusted”zones within the advanced wireless gateway or similar device, in that itis not desirable for these publicly accessible zones to have access tothe customer's interior LAN, which can include confidential and/orprotected information stores and other data sources that a customerwould generally not wish to expose.

One or more non-limiting exemplary embodiments are applicable tosmall-scale small office and/or home networks. However, aspects of anexemplary framework can be scaled from very small to very largeproportions. One or more embodiments advantageously provide a simpletechnique that can be re-used regardless of the size of the prefixallocated, and/or or that provides consistency in a dual stackenvironment (both IPv4 and IPv6 allocation on the router of the advancedwireless gateway or similar device).

FIG. 6 shows an alternative embodiment. Elements similar to those inFIG. 5 and having the same reference character are not described again.Here, the division of /56 502 is into two /58 networks 504, 506 and a/57 network 602 broken into eight /60 sub-prefixes 510, allocated asshown.

FIG. 7 shows an alternative embodiment with elements similar to those inFIGS. 5 and 6 having the same reference character and not describedagain. Here, the division of /56 502 is into two /57 networks 751, 602.The latter is again broken into eight /60 sub-prefixes 510. The formeris broken into 128/64 networks 508, allocated as shown.

In one or more embodiments, the first sub-prefix is used for /64networks assigned to interfaces. The second prefix is used forsub-prefix delegation to additional routers for their own interfaces.For example, in FIG. 5, SSID1 508 under 506 is an SSID made availablefrom the advanced wireless gateway or similar device to allow connectionby wireless devices. On the other hand, SSID1 510 under 514 depicts theadvanced wireless gateway or similar device connecting to another routerinstead of connecting to devices. In one or more embodiments, prefixesare assigned to links but individual devices are assigned addresses.

FIG. 8 shows exemplary IPv4 public and private sub-network allocation.In particular, FIG. 8 shows LAN interfaces and DHCP pools for anadvanced wireless gateway employing IPv4. The exemplary advancedwireless gateway uses NAPT (network address and port translation) forDHCP supplied public /32 and may use RIPv2 route announcements forstatic routed subnets of /30 to /24 for commercial modes of operation.In one or more IPv4 instances, the advanced wireless gateway or similardevice has two processes; namely, a DHCP client and a DHCP server. TheDHCP client is used to request a single IPv4 address (/32), which isthen given to the gateway. When the gateway provides addresses toclients behind the gateway, it functions as a DHCP server, providingprivate RFC 1918 addresses and mapping same to ports on the singlepublic address. If the device is addressed with static public addresseswithout NAPT (e.g., commercial), the exemplary advanced wireless gatewaymust have enough addresses for client blocks and all routers within thetopology. Due to the aforementioned IPv4 address exhaustion, use oflarge blocks of static IP is not considered to be realistic for themedium to long term. Thus, to summarize, there are three possible cases,namely, (i) no NAT, commercial; (ii) NAT with static assignment of IPv4address without DHCP; and (iii) NAT with DHCP client without staticassignment of IPv4 address (often used in commercial and residential).

Thus, with continued reference to FIG. 8, note public address 802,unique throughout the world, facing the Internet. Note also privatenetwork 804, not unique in the world, and having context only in thepremises network; under private network 804 note also subdivisions forwired LAN 806, MoCA 808, and WiFi SSID 810, all of which are in theprivate address space. In essence, one or more IPv4 embodiments “mirror”what is done in the IPv6 embodiments but with significantly smallersub-nets because of the smaller address space. That is, in one or moreIPv4 embodiments, give 254 addresses to each of the individualinterfaces.

FIG. 9 shows exemplary IPv4 and IPv6 zones and groups. Example 902depicts a configuration with a single trusted zone 910 and a singleun-trusted zone 912. An Internal Ethernet LAN including all fourEthernet ports 916, 918, 920, 922; a single MoCA interface 924; andthree of the five WiFi SSIDs 926, 928, 930 are all part of the singletrusted zone 910. The public facing “hot spot” SSIDs 932, 934 constitutethe single un-trusted zone 912.

Example 904 depicts a configuration with a single trusted zone 940 andtwo un-trusted zones 912 (same as case 902), 942. The Ethernet LANincluding three of the four ports 916, 918, 920; the single MoCAinterface 924; and three of the five WiFi SSIDs 926, 928, 930 are on thetrusted zone 940, while port 4 (Eth3) 922 of the Ethernet LAN is on thesecond un-trusted zone 942 established as a DMZ perimeter for allowingpublic servers.

Example 906 depicts a configuration with two trusted zones 950, 952 anda single un-trusted zone 912 (same as case 902). An Ethernet LANincluding three of the four ports 916, 918, 920; the single MoCAinterface 924; and three of the five WiFi SSIDs 926, 928, 930 are on theTrust1 zone 950, while port 4 (Eth3) of the Ethernet LAN 922 is on theTrust2 zone 952 established to allow a split tunnel configuration.

Example 908 depicts a configuration with two trusted zones 960, 962 andtwo un-trusted zones 964, 966. An Ethernet LAN including two of the fourports 916, 918; the single MoCA interface 924; and three of the fiveWiFi SSIDs 926, 928, 930 are on the Trust1 zone 960, while Ethernet port3 (Eth2) 920 is used for the Trust2 zone 962 for split tunnel support.Ethernet Port 4 (Eth3) 922 is on the Untrustd1 zone 964 established as aDMZ perimeter for allowing public servers and the Untrustd2 zone 966 isestablished for SSID4 932 and SSID5 934.

Some non-limiting exemplary embodiments support 2-5 routers per home orother premises; it is believed that 3 routers is a realistic number inone or more instances.

Exemplary Software and Hardware Implementation

In a non-limiting exemplary embodiment, an advanced wireless gateway orsimilar device includes, in terms of hardware, four-port Ethernet switch304, MoCA interface 391, and multiple SSIDs 302 supporting a wirelessaccess point. In terms of software layers, a suitable route process,policy engine, firewall, and SQL packet inspection control run on top ofthe physical ports associated with the switch 304, physical MoCAinterface 391, RF interface 301, and wireless access point 302 and itsassociated radios. Thus, in one or more embodiments, the software layersare stored in persistent storage 308 and when the gateway boots, thesoftware is loaded into memory 310 causing microprocessor 306 toconfigure the interfaces and ports in accordance with the prefixdesignation logic as shown in the figures.

Recapitulation

Attention should now be given to flow chart 2000 of FIG. 10, whichbegins at 2002. Given the discussion thus far, it will be appreciatedthat, in general terms, an exemplary method, according to an aspect ofthe invention, includes the step 2006 of dividing a delegated internetprotocol version six prefix into a lower-numbered portion (e.g., a half)such as (504 and 506) or 751 and a higher-numbered portion (e.g., ahalf) such as (512 and 514) or 602. The delegated prefix is assigned toa gateway device which is interposed between an internet and a premises.A further step 2008 includes allocating either the lower-numberedportion (e.g., half) or the higher-numbered portion (e.g., half) to aplurality of networks such as 508 associated with the premises. Theplurality of networks could include, for example, a single customernetwork with a plurality of sub networks. Still further steps include,at 2010, breaking the other portion (e.g., half) into a plurality ofblocks such as 510 for use in prefix delegation for allocation torouters associated with the premises requesting the prefix delegation;and, at 2014, operating the gateway device in accordance with thedividing, allocating, and breaking steps.

Processing Continues at 2018.

Operating the gateway device in accordance with the dividing,allocating, and breaking includes, for example, sending packets todifferent ports corresponding to the allocation. In one or moreembodiments, the gateway device is on the edge/perimeter and otherrouters in the home network(s) are in the core. In some cases, thegateway device renews leases on granted prefixes.

In one or more embodiments, the steps described thus far are carried outby the gateway device or a similar device. As used herein, Internet withthe capital “I” is the global Internet, while “internet” is a genericdescription of any inter-network of computer systems and routingtopologies. In one or more embodiments, the decision on which parts of agiven prefix to use in a given way is completely arbitrary, but followslogic on how a home router's interfaces are typically implemented andhow they are used. While in some instances, there may be only perhapsone or two subnets within the home, the elimination of NAT and the needfor more specific security policies leads to more networks within thehome, effectively one network per interface type and one each forwireless SSIDs. In some cases, there may be, for example, six for aresidential customer and as many as nine or ten for a commercialcustomer with more business-centric needs. These values are exemplaryand non-limiting. While IPv4 does not necessarily have to be dividedinto all of these networks, it is advisable to use the same IPallocation for one protocol as for another to prevent complicating theadministration or configuration of the router.

Optionally, a further step 2012 includes pre-categorizing at least someof the plurality of networks associated with the premises into at leastfirst and second trust zones; for non-limiting examples, refer to FIG. 9and accompanying text. In such cases, as indicated by the parenthetical“(and trust zones),” the operating step 2014 can further includeoperating the gateway device in accordance with the pre-categorizingstep.

In some instances, an additional step 2004 includes assigning, to thegateway device, the delegated internet protocol version six prefix. Thiscould be carried out, for example, by the MSO or the like.

In some instances, as noted, the internet is the Internet, i.e., theglobal system of interconnected computer networks that use transfercontrol protocol/internet protocol (TCP/IP) to serve very large numbersof users worldwide. The Internet is a network of networks includingmillions of private, public, academic, business, and governmentnetworks, of local to global scope, that are linked by a broad array ofelectronic, wireless and optical networking technologies. The Internetcarries a vast range of information resources and services, such as theinter-linked hypertext documents of the World Wide Web (WWW) and theinfrastructure to support electronic mail. The Internet may also bereferred to herein as a global internet. Internetworking is the practiceof connecting a computer network with other networks through the use ofgateways that provide a common method of routing information packetsbetween the networks. The resulting system of interconnected networks iscalled an internetwork, or simply an internet (lower case).

As noted, in some instances, the lower-numbered portion is thelower-numbered half and the higher-numbered portion is thehigher-numbered half. In some cases, the lower-numbered half isallocated to the plurality of networks associated with the premises, andthe higher-numbered half is broken into the plurality of blocks for usein the prefix delegation.

As noted, in some cases, the delegated internet protocol version sixprefix is a /56 delegated prefix such as 502, and the plurality ofnetworks associated with the premises comprise one hundred twenty eight/64 networks such as 508. Furthermore, in some cases, the allocating ofthe lower-numbered half to the plurality of networks associated with thepremises further includes breaking the lower-numbered half in half toobtain a lower-numbered /58 network quarter such as 504 and ahigher-numbered /58 network quarter such as 506; assigning thelower-numbered /58 network quarter such as 504 to sixty four wired onesof the one hundred twenty eight /64 networks; and assigning thehigher-numbered /58 network quarter such as 506 to sixty four wirelessones of the one hundred twenty eight /64 networks. Furthermore, in somecases, the plurality of blocks such as 510 for use in the prefixdelegation comprise /60 prefixes. Please note that “prefixes” and“blocks” are used somewhat interchangeably herein. The term “blocks” isalso used to refer to blocks in the block diagrams. The skilled artisanwill appreciate the intended meaning from the context.

With particular reference to FIG. 5, in some cases, the breaking of thehigher-numbered half into the plurality of blocks further includesbreaking the higher-numbered half in half to obtain a lower-numbered /58prefix delegation quarter such as 512 and a higher-numbered /58 prefixdelegation quarter; such as 514; assigning the lower-numbered /58 prefixdelegation quarter such as 512 to prefix delegation associated withwired local area networks; and assigning the higher-numbered /58 prefixdelegation quarter such as 514 to prefix delegation associated withwireless local area networks. In one or more embodiments, the router'slocal DHCP-PD server could assign sub-prefixes while being assigned a/64 network to each interface.

With particular reference to FIG. 6, in some cases, the higher-numberedhalf such as 602 is a /57 half that is not broken down further.

With particular reference to FIG. 7, in some cases, the lower- andhigher-numbered halves such as 751, 602 are each /57 halves that are notbroken down further.

Note that “not broken down further” is intended to refer to cases suchas the right hand side of FIG. 6 and both sides in FIG. 7, as opposedto, say, the left-hand side of FIG. 6. Note also that “not broken downfurther” does not preclude assignment of individual networks therein.

Reference should now be had to FIGS. 3 and 9. In a non-limiting example,a gateway device such as 106 has a four-port Ethernet switch such as304, a multimedia over coaxial cable interface such as 391, and awireless interface such as 302 having five service set identifiers(e.g., SSIDs). Referring to 902, in some cases, a first trust zone suchas 910 is a trusted zone and a second trust zone such as 912 is anun-trusted zone. One example of pre-categorizing includes assigning thefour-port Ethernet switch, the multimedia over coaxial cable interface,and a lowest numbered three of the five service set identifiers to thefirst trust zone, as seen at 916, 918, 920, 922, 924, 926, 928, and 930in example 902; as well as assigning a highest numbered two of the fiveservice set identifiers to the second trust zone, as seen at 932, 934 inexample 902. In such cases, step 2014 can include allowing packets totravel from the trusted zone to the un-trusted zone but not from theun-trusted zone to the trusted zone.

Referring to 904, in some cases, the pre-categorizing further includespre-categorizing into at least a third trust zone such as 942; the firsttrust zone such as 940 is a trusted zone, and the second and third trustzones such as 912, 942 are un-trusted zones. Another example ofpre-categorizing includes assigning a lowest three numbered ports of thefour-port Ethernet switch, the multimedia over coaxial cable interface,and a lowest numbered three of the five service set identifiers to thefirst trust zone, as seen at 916, 918, 920, 924, 926, 928, and 930 inexample 904; as well as assigning a highest numbered two of the fiveservice set identifiers to the second trust zone, as seen at 932, 934 inexample 904, and assigning a highest numbered one of the ports of thefour-port Ethernet switch to the third trust zone, as seen at 922 inexample 904. In such cases, step 2014 can include allowing packets totravel from the trusted zone to either of the un-trusted zones but notfrom either of the un-trusted zones to the trusted zone. In some cases,with multiple untrusted zones, packets might be allowed to travel fromone untrusted zone to another. However, in some instances, there mightbe multiple levels of trust, possibly assigned numerical values, inwhich case some untrusted zones might be more relatively more trustedthan another untrusted zone. In such cases, packets might be allowed totravel from the untrusted zone with higher trust to the untrusted zonewith lower trust, but not vice versa. In some instances, the WANinterface is the untrusted zone unless additional interfaces areconfigured to join the untrusted zone and leave the trusted zone. Anexample would include a customer placing a publicly accessible serveronto a DMZ type of interface which would fall into the “untrusted”category.

Referring to 906, in some cases, the pre-categorizing further includespre-categorizing into at least a third trust zone such as 952. The firstand third trust zones such as 950 and 952 are trusted zones, and thesecond trust zone such as 912 is an un-trusted zone. Still anotherexample of pre-categorizing includes assigning a lowest three numberedports of the four-port Ethernet switch, the multimedia over coaxialcable interface, and a lowest numbered three of the five service setidentifiers to the first trust zone, as seen at 916, 918, 920 924, 926,928, and 930 in example 906; as well as assigning a highest numbered twoof the five service set identifiers to the second trust zone, as seen at932, 934 in example 906, and assigning a highest numbered one of theports of the four-port Ethernet switch to the third trust zone, as seenat 922 in example 906. In such cases, step 2014 can include allowingpackets to travel from either of the trusted zones to the un-trustedzone; allowing packets to travel between the trusted zones; and notallowing packets to travel from the un-trusted zone to either of thetrusted zones.

Referring to 908, in some cases, the pre-categorizing further includespre-categorizing into at least a third trust zone such as 962 and afourth trust zone such as 964. Note that the un-trusted zone with SSID4and SSID5 is re-numbered as 966 in example 908 because it is labeled“Untrustd2” therein. The first and third trust zones are trusted zones;and the second and fourth trust zones are un-trusted zones. An evenfurther example of pre-categorizing includes assigning a lowest twonumbered ports of the four-port Ethernet switch, the multimedia overcoaxial cable interface, and a lowest numbered three of the five serviceset identifiers to the first trust zone, as seen at 916, 918, 924, 926,928, and 930 in example 906; assigning a highest numbered two of thefive service set identifiers to the second trust zone 966, as seen at932, 934 in example 908; assigning a next highest numbered one of theports of the four-port Ethernet switch to the third trust zone 962, asseen at 920 in example 908; and assigning a most highly numbered one ofthe ports of the four-port Ethernet switch to the fourth trust zone 964,as seen at 922 in example 908. In such cases, step 2014 can includeallowing packets to travel from either of the trusted zones to either ofthe un-trusted zones; allowing packets to travel between the trustedzones; and not allowing packets to travel from either of the un-trustedzones to either of the trusted zones.

Again, as an implementation detail, there can be more than one trustedand one untrusted zone. A cascade of different “weights” could beapplied so that a higher “trust” would limit access in the same manneras the simplified “trusted” or “untrusted” example. In effect, a highernumeric trust would correspond to a higher level of trust and any lowertrust assigned to a different interface would be unable to forwardpackets to that interface. In the simplest implementation where only twozones exist, any interface that is added to the “untrusted” is at thatsingle plane of trust and therefore implicitly allowed to communicateamong any interfaces within that zone.

As noted elsewhere, in some cases, step 2014 includes applying the atleast first and second trust zones as policy inputs to a firewallassociated with the gateway device. A suitable packet processor inspectsthe packets and compares them against the list of packets associatedwith a trusted network, e.g., by physical interface, by MAC address, andby IP address, and drops or forwards packets as appropriate.Microprocessor 306 may be provided with packet inspection functionality,and policies may be provided in persistent storage 308 (e.g., asconfiguration parameters to run within the firewall software) and loadedinto memory 310 to cause processor 306 to take appropriate actions witheach packet based on the policies.

Optional step 2016 includes remotely diagnosing at least one problemassociated with at least one of the plurality of networks such as 508associated with the premises, based on the allocating step 2008. One ormore embodiments assist customer service representatives when they get acall from one of the subscribers saying, for example, that his or hertablet device is not working. The standardized assignment of prefixeshelps in remote diagnosis.

With reference to FIG. 8, another exemplary method includes obtaining aninternet protocol version four public address 802 associated with agateway device which is interposed between an internet and a premises.In accordance with predetermined rules, a private address space for thepremises is divided into at least a first subdivision for at least oneof a wired sub-network, a wireless sub-network, and a multimedia overcoaxial cable interface (e.g., 806), and a second subdivision for atleast another one of the wired sub-network, the wireless sub-network,and the multimedia over coaxial cable interface (e.g. 808 or 810). Afirst trust value is assigned to at least a portion of the firstsubdivision and a second trust value is assigned to at least a portionof the second subdivision in accordance with the predetermined rules.Purely by way of example, the wired and/or MoCA interfaces could betrusted and the SSIDs could be partially trusted and partiallyuntrusted. A further step includes operating the gateway device inaccordance with the obtaining, dividing, and assigning steps.

In another aspect, one or more embodiments include an article ofmanufacture including a computer program product, the computer programproduct including a tangible computer-readable recordable storagemedium, storing in a non-transitory manner computer readable programcode, the computer readable program code including computer readableprogram code configured to carry out or otherwise facilitate any one,some, or all of any of the methods steps described herein.

In still another aspect, an exemplary gateway device (FIG. 3 shows anon-limiting example) is provided for interposition between an internetand a premises. The apparatus includes a memory 310 and at least oneprocessor 306 that is coupled to the memory and operative to carry outor otherwise facilitate any one, some, or all of any of the methodssteps described herein. For example, the at least one processor may beoperative to divide a delegated internet protocol version six prefix,which is assigned to the gateway device, into a lower-numbered portionand a higher-numbered portion; allocate one of the portions to aplurality of networks associated with the premises; break the otherportion into a plurality of blocks for use in prefix delegation forallocation to routers associated with the premises requesting the prefixdelegation; and operate the gateway device in accordance with thedividing, allocating, and breaking.

In some instances, the at least one processor is further operative topre-categorize at least some of the plurality of networks associatedwith the premises into at least first and second trust zones, and the atleast one processor is operative to operate the gateway device inaccordance with the pre-categorizing.

In some instances, the lower-numbered portion is the lower-numbered halfand the higher-numbered portion is the higher-numbered half.

In some cases, the lower-numbered half is allocated to the plurality ofnetworks associated with the premises, and the higher-numbered half isbroken into the plurality of blocks for use in the prefix delegation.

In a non-limiting example, the device may further include a wirednetwork switch 304, coupled to the memory and the at least oneprocessor; a multimedia over coaxial cable interface 391, coupled to thememory and the at least one processor; and a wireless interface 302having a plurality of set identifiers, coupled to the memory and the atleast one processor. In some such cases, the first trust zone is atrusted zone and the second trust zone is an un-trusted zone. In someinstances, the pre-categorizing includes: assigning the wired networkswitch, the multimedia over coaxial cable interface, and a first portionof the service set identifiers to the first trust zone; and assigning asecond portion of the service set identifiers to the second trust zone.Furthermore, in some such cases, operating in accordance with thepre-categorizing includes allowing packets to travel from the trustedzone to the un-trusted zone but not from the un-trusted zone to thetrusted zone.

System and Article of Manufacture Details

The invention can employ hardware aspects or a combination of hardwareand software aspects. Software includes but is not limited to firmware,resident software, microcode, etc. One or more embodiments of theinvention or elements thereof can be implemented in the form of anarticle of manufacture including a machine readable medium that containsone or more programs which when executed implement such step(s); that isto say, a computer program product including a tangible computerreadable recordable storage medium (or multiple such media) withcomputer usable program code configured to implement the method stepsindicated, when run on one or more processors. Furthermore, one or moreembodiments of the invention or elements thereof can be implemented inthe form of an apparatus including a memory and at least one processorthat is coupled to the memory and operative to perform, or facilitateperformance of, exemplary method steps.

Yet further, in another aspect, one or more embodiments of the inventionor elements thereof can be implemented in the form of means for carryingout one or more of the method steps described herein; the means caninclude (i) specialized hardware module(s), (ii) software module(s)executing on one or more general purpose or specialized hardwareprocessors, or (iii) a combination of (i) and (ii); any of (i)-(iii)implement the specific techniques set forth herein, and the softwaremodules are stored in a tangible computer-readable recordable storagemedium (or multiple such media). Appropriate interconnections via bus,network, and the like can also be included.

In some instances, a portal server 3303 in head end 150 (shown on LAN158 but could also be on LAN 160) is employed; for example, asignificant portion of the configuration information, and the userinterface, could be located on portal server 3303. This configurationcould then be pushed down to the router.

Many aspects of the invention can be implemented, for example, on anadvanced wireless gateway or similar device, as shown in FIG. 3, withsuitable software layers to implement logic as described herein. Someaspects of the invention may involve a server or other general purposecomputer. FIG. 11 is a block diagram of a system 2100 that can implementsome pertinent aspects or processes, processor 2120 of which isrepresentative of processors associated with servers, clients, set topterminals or gateways 106, DBWAD, SRM, GSRM, MAS 104A, personal mediadevices, portal server 3303, smart phones, desktop or laptop computers,smart roaming devices, and any other elements with processing capabilitydepicted in the other figures. In one or more embodiments, inventivesteps are carried out by one or more of the processors in conjunctionwith one or more interconnecting network(s). Again, in some cases, mostor all steps are carried out, or at least facilitated by, the advancedwireless gateway of FIG. 3 or a device with similar functionality.

As shown in FIG. 11, memory 2130 configures the processor 2120 toimplement one or more aspects of the methods, steps, and functionsdisclosed herein (collectively, shown as process 2180 in FIG. 11). Thememory 2130 could be distributed or local and the processor 2120 couldbe distributed or singular. The memory 2130 could be implemented as anelectrical, magnetic or optical memory, or any combination of these orother types of storage devices. It should be noted that if distributedprocessors are employed, each distributed processor that makes upprocessor 2120 generally contains its own addressable memory space. Itshould also be noted that some or all of computer system 2100 can beincorporated into an application-specific or general-use integratedcircuit. For example, one or more method steps could be implemented inhardware in an ASIC rather than using firmware. Display 2140 isrepresentative of a variety of possible input/output devices (e.g.,mice, keyboards, printers, etc.).

As is known in the art, part or all of one or more aspects of themethods and apparatus discussed herein may be distributed as an articleof manufacture that itself includes a computer readable medium havingcomputer readable code means embodied thereon. The computer readableprogram code means is operable, in conjunction with a computer systemincluding hardware, to carry out all or some of the steps to perform themethods or create the apparatuses discussed herein. The computerreadable medium may be a recordable medium (e.g., floppy disks, harddrives, compact disks, EEPROMs, or memory cards) or may be atransmission medium (e.g., a network including fiber-optics, theworld-wide web, cables, or a wireless channel using time-divisionmultiple access, code-division multiple access, or other radio-frequencychannel). Any medium known or developed that can store informationsuitable for use with a computer system may be used. Thecomputer-readable code means is any mechanism for allowing a computer toread instructions and data, such as magnetic variations on a magneticmedium or height variations on the surface of a compact disk. As usedherein, a tangible computer-readable recordable storage medium isintended to encompass a recordable medium which stores instructionsand/or data in a non-transitory manner, examples of which are set forthabove, but is not intended to encompass a transmission medium ordisembodied signal.

The computer systems and servers described herein each contain a memorythat will configure associated processors to implement the methods,steps, and functions disclosed herein. Such methods, steps, andfunctions can be carried out, e.g., by processing capability onindividual elements in the other figures, or by any combination thereof.The memories could be distributed or local and the processors could bedistributed or singular. The memories could be implemented as anelectrical, magnetic or optical memory, or any combination of these orother types of storage devices. Moreover, in some instances (e.g., theportal server), the term “memory” encompasses any information able to beread from or written to an address in the addressable space accessed byan associated processor. With this definition, information on a networkis still within a memory because the associated processor can retrievethe information from the network.

Thus, elements of one or more embodiments of the present invention canmake use of computer technology with appropriate instructions toimplement method steps described herein.

As used herein, including the claims, a “server” includes a physicaldata processing system (for example, system 2100 as shown in FIG. 11)running a server program. It will be understood that such a physicalserver may or may not include a display, keyboard, or other input/outputcomponents.

Furthermore, it should be noted that any of the methods described hereincan include an additional step of providing a system comprising distinctsoftware modules embodied on one or more tangible computer readablestorage media. All the modules (or any subset thereof) can be on thesame medium, or each can be on a different medium, for example. Themodules can include, for example, a firewall policy module and a prefixassignment module; any or all of the software components shown in thefigures can be implemented with suitable modules. The method steps canthen be carried out using the distinct software modules of the system,as described above, executing on the one or more hardware processors.Further, a computer program product can include a tangiblecomputer-readable recordable storage medium with code adapted to beexecuted to carry out one or more method steps described herein,including the provision of the system with the distinct softwaremodules. In one or more embodiments, the code is stored in anon-transitory manner.

Non-limiting examples of languages that may be used include markuplanguages (e.g., hypertext markup language (HTML), extensible markuplanguage (XML), standard generalized markup language (SGML), and thelike), C/C++, assembly language, Pascal, Java, EBIF—Extended BinaryInterchange Format language, UNIX shell scripts (for example, togenerate information to supply to the GSRM), and the like. Note thatEBIF would typically only be employed in connection with a set-top box.RTSP and/or RPC can be employed for interface protocols, for example.Furthermore, non-limiting examples of useful database software includeAccess® software (registered mark of Microsoft Corporation, Redmond,Wash., USA); Oracle® software (registered mark of Oracle InternationalCorporation, 500 Oracle Parkway, Redwood City, Calif. 94065, USA);Informix® software (registered mark of International Business MachinesCorporation, Armonk, N.Y., USA); and structured query language (SQL)software available from many sources, including Microsoft Corporation,Redmond, Wash., USA).

Accordingly, it will be appreciated that one or more embodiments of theinvention can include a computer program including computer program codemeans adapted to perform one or all of the steps of any methods orclaims set forth herein when such program is implemented on a processor,and that such program may be embodied on a tangible computer readablerecordable storage medium. Further, one or more embodiments of thepresent invention can include a processor including code adapted tocause the processor to carry out one or more steps of methods or claimsset forth herein, together with one or more apparatus elements orfeatures as depicted and described herein.

System(s) have been described herein in a form in which variousfunctions are performed by discrete functional blocks. However, any oneor more of these functions could equally well be embodied in anarrangement in which the functions of any one or more of those blocks orindeed, all of the functions thereof, are realized, for example, by oneor more appropriately programmed processors such as digital signalprocessors (DSPs). Thus, any blocks, components, sub-blocks,sub-components, modules and/or sub-modules may be realized by one ormore DSPs. A DSP typically comprises a combination of digital logicdevices and other components, which may be a state machine orimplemented with a dedicated microprocessor or micro-controller runninga software program or having functions programmed in firmware.

Although illustrative embodiments of the present invention have beendescribed herein with reference to the accompanying drawings, it is tobe understood that the invention is not limited to those preciseembodiments, and that various other changes and modifications may bemade by one skilled in the art without departing from the scope orspirit of the invention.

What is claimed is:
 1. A method comprising the steps of: dividing adelegated internet protocol version six prefix, which is assigned to agateway device which is interposed between an internet and a premises,into a lower-numbered portion and a higher-numbered portion; allocatingone of said lower-numbered portion and said higher-numbered portion to aplurality of networks associated with said premises; breaking anotherone of said lower-numbered portion and said higher-numbered portion intoa plurality of blocks for use in prefix delegation for allocation torouters associated with said premises requesting said prefix delegation;and operating said gateway device in accordance with said dividing,allocating, and breaking steps.
 2. The method of claim 1, furthercomprising pre-categorizing at least some of said plurality of networksassociated with said premises into at least first and second trustzones, wherein said operating step further comprises operating saidgateway device in accordance with said pre-categorizing step.
 3. Themethod of claim 2, further comprising assigning, to said gateway device,said delegated internet protocol version six prefix.
 4. The method ofclaim 2, wherein said internet comprises the Internet.
 5. The method ofclaim 4, wherein said lower-numbered portion comprises a lower-numberedhalf and said higher-numbered portion comprises a higher-numbered half.6. The method of claim 5, wherein: said lower-numbered half is allocatedto said plurality of networks associated with said premises; and saidhigher-numbered half is broken into said plurality of blocks for use insaid prefix delegation.
 7. The method of claim 6, wherein: saiddelegated internet protocol version six prefix comprises a /56 delegatedprefix; said plurality of networks associated with said premisescomprise one hundred twenty eight /64 networks; said allocating of saidlower-numbered half to said plurality of networks associated with saidpremises further comprises: breaking said lower-numbered half in half toobtain a lower-numbered /58 network quarter and a higher-numbered /58network quarter; assigning said lower-numbered /58 network quarter tosixty four wired ones of said one hundred twenty eight /64 networks; andassigning said higher-numbered /58 network quarter to sixty fourwireless ones of said one hundred twenty eight /64 networks; and saidplurality of blocks for use in said prefix delegation comprise /60blocks.
 8. The method of claim 7, wherein said breaking of saidhigher-numbered half into said plurality of blocks further comprises:breaking said higher-numbered half in half to obtain a lower-numbered/58 prefix delegation quarter and a higher-numbered /58 prefixdelegation quarter; assigning said lower-numbered /58 prefix delegationquarter to prefix delegation associated with wired local area networks;and assigning said higher-numbered /58 prefix delegation quarter toprefix delegation associated with wireless local area networks.
 9. Themethod of claim 7, wherein said higher-numbered half comprises a /57half that is not broken down further.
 10. The method of claim 6, whereinsaid lower- and higher-numbered halves each comprise a /57 half that isnot broken down further.
 11. The method of claim 2, wherein: saidgateway device comprises a four-port Ethernet switch, a multimedia overcoaxial cable interface, and a wireless interface having five serviceset identifiers; said first trust zone comprises a trusted zone; saidsecond trust zone comprises an un-trusted zone; said pre-categorizingcomprises: assigning said four-port Ethernet switch, said multimediaover coaxial cable interface, and a lowest numbered three of said fiveservice set identifiers to said first trust zone; and assigning ahighest numbered two of said five service set identifiers to said secondtrust zone; and said operating in accordance with said pre-categorizingstep comprises allowing packets to travel from said trusted zone to saidun-trusted zone but not from said un-trusted zone to said trusted zone.12. The method of claim 2, wherein: said pre-categorizing furthercomprises pre-categorizing into at least a third trust zone: saidgateway device comprises a four-port Ethernet switch, a multimedia overcoaxial cable interface, and a wireless interface having five serviceset identifiers; said first trust zone comprises a trusted zone; saidsecond and third trust zones comprise un-trusted zones; saidpre-categorizing comprises: assigning a lowest three numbered ports ofsaid four-port Ethernet switch, said multimedia over coaxial cableinterface, and a lowest numbered three of said five service setidentifiers to said first trust zone; assigning a highest numbered twoof said five service set identifiers to said second trust zone; andassigning a highest numbered one of said ports of said four-portEthernet switch to said third trust zone; and said operating inaccordance with said pre-categorizing step comprises allowing packets totravel from said trusted zone to either of said un-trusted zones but notfrom either of said un-trusted zones to said trusted zone.
 13. Themethod of claim 2, wherein: said pre-categorizing further comprisespre-categorizing into at least a third trust Zone; said gateway devicecomprises a four-port Ethernet switch, a multimedia over coaxial cableinterface, and a wireless interface having five service set identifiers;said first and third trust zones comprise trusted zones; said secondtrust zone comprise an un-trusted zone; said pre-categorizing furthercomprises: assigning a lowest three numbered ports of said four-portEthernet switch. said multimedia over coaxial cable interface, and alowest numbered three of said five service set identifiers to said firsttrust zone; assigning a highest numbered two of said five service setidentifiers to said second trust zone; and assigning a highest numberedone of said ports of said four-port Ethernet switch to said third trustzone; and said operating in accordance with said pre-categorizing stepcomprises: allowing packets to travel from either of said trusted zonesto said un-trusted zone; allowing packets to travel between said trustedzones; and not allowing packets to travel from said un-trusted zone toeither of said trusted zones.
 14. The method of claim 2, wherein: saidpre-categorizing further comprises pre-categorizing into at least athird trust zone and a fourth trust zone; said gateway device comprisesa four-port Ethernet switch, a multimedia over coaxial cable interface,and a wireless interface having five service set identifiers; said firstand third trust zones comprise trusted zones; said second and fourthtrust zones comprise un-trusted zones; said pre-categorizing furthercomprises: assigning a lowest two numbered ports of said four-portEthernet switch, said multimedia over coaxial cable interface, and alowest numbered three of said five service set identifiers to said firsttrust zone; assigning a highest numbered two of said five service setidentifiers to said second trust zone; assigning a next highest numberedone of said ports of said four-port Ethernet switch to said third trustzone; and assigning a most highly numbered one of said ports of saidfour-port Ethernet switch to said fourth trust zone; and said operatingin accordance with said pre-categorizing step comprises: allowingpackets to travel from either of said trusted zones to either of saidun-trusted zones; allowing packets to travel between said trusted zones;and not allowing packets to travel from either of said un-trusted zonesto either of said trusted zones.
 15. The method of claim 2, wherein saidoperating of said gateway device in accordance with saidpre-categorizing step further comprises applying said at least first andsecond trust zones as policy inputs to a firewall associated with saidgateway device.
 16. The method of claim 1, further comprising remotelydiagnosing at least one problem associated with at least one of saidplurality of networks associated with said premises, based on saidallocating step.
 17. An article of manufacture comprising a computerprogram product, said computer program product comprising: a tangiblecomputer-readable recordable storage medium, storing in a non-transitorymanner computer readable program code, the computer readable programcode comprising: computer readable program code configured to divide adelegated internet protocol version six prefix, which is assigned to agateway device which is interposed between an internet and a premises,into a lower-numbered portion and a higher-numbered portion; computerreadable program code configured to allocate one of said lower-numberedportion and said higher-numbered portion to a plurality of networksassociated with said premises; computer readable program code configuredto break another one of said lower-numbered portion and saidhigher-numbered portion into a plurality of blocks for use in prefixdelegation for allocation to routers associated with said premisesrequesting said prefix delegation; and computer readable program codeconfigured to operate said gateway device in accordance with saiddividing, allocating, and breaking.
 18. The article of manufacture ofclaim 1, further comprising computer readable program code configured topre-categorize at least some of said plurality of networks associatedwith said premises into at least first and second trust zones, whereinsaid computer readable program code configured to operate furthercomprises computer readable program code configured to operate saidgateway device in accordance with said pre-categorizing.
 19. Anapparatus comprising: means for dividing a delegated internet protocolversion six prefix, which is assigned to a gateway device which isinterposed between an internet and a premises, into a lower-numberedportion and a higher-numbered portion; means for allocating one of saidlower-numbered portion and said higher-numbered portion to a pluralityof networks associated with said premises; means for breaking anotherone of said lower-numbered portion and said higher-numbered portion intoa plurality of blocks for use in prefix delegation for allocation torouters associated with said premises requesting said prefix delegation;and means for operating said gateway device in accordance with saiddividing, allocating, and breaking.
 20. The apparatus of claim 19,further comprising means for pre-categorizing at least some of saidplurality of networks associated with said premises into at least firstand second trust zones, wherein said means for operating furthercomprise means for operating said gateway device in accordance with saidpre-categorizing.
 21. A gateway device for interposition between aninternet and a premises, said gateway apparatus comprising: a memory;and at least one processor, coupled to said memory, and operative to:divide a delegated internet protocol version six prefix, which isassigned to said gateway device, into a lower-numbered portion and ahigher-numbered portion; allocate one of said lower-numbered portion andsaid higher-numbered portion to a plurality of networks associated withsaid premises; break another one of said lower-numbered portion and saidhigher-numbered portion into a plurality of blocks for use in prefixdelegation for allocation to routers associated with said premisesrequesting said prefix delegation; and operate said gateway device inaccordance with said dividing, allocating, and breaking.
 22. The gatewaydevice of claim 21, wherein said at least one processor is furtheroperative to pre-categorize at least some of said plurality of networksassociated with said premises into at least first and second trustzones, and wherein said at least one processor is operative to operatesaid gateway device in accordance with said pre-categorizing.
 23. Thegateway device of claim 22, wherein said lower-numbered portioncomprises a lower-numbered half and said higher-numbered portioncomprises a higher-numbered half.
 24. The gateway device of claim 23,wherein: said lower-numbered half is allocated to said plurality ofnetworks associated with said premises; and said higher-numbered half isbroken into said plurality of blocks for use in said prefix delegation.25. The gateway device of claim 22, further comprising: a wired networkswitch, coupled to said memory and said at least one processor; amultimedia over coaxial cable interface, coupled to said memory and saidat least one processor; and a wireless interface having a plurality ofset identifiers, coupled to said memory and said at least one processor;wherein: said first trust zone comprises a trusted zone; said secondtrust zone comprises an un-trusted zone; said pre-categorizingcomprises: assigning said wired network switch, said multimedia overcoaxial cable interface, and a first portion of said service setidentifiers to said first trust zone; and assigning a second portion ofsaid service set identifiers to said second trust zone; and saidoperating in accordance with said pre-categorizing comprises allowingpackets to travel from said trusted zone to said un-trusted zone but notfrom said un-trusted zone to said trusted zone.